5438 matches found
CVE-2018-19436
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter...
CVE-2018-19436
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter...
CVE-2018-19434
The CVE-2018-19434 issue affects webERP 4.15 within the General Ledger component, specifically the Bank Account Matching - Receipts screen. BankMatching.php contains a Blind SQL injection vulnerability via the AmtClear_ parameter that can be exploited remotely to execute SQL commands. This vulner...
CVE-2018-19436
CVE-2018-19436 affects webERP v4.15, specifically the Manufacturing component. The vulnerability is a Blind SQL Injection in CollectiveWorkOrderCost.php exposed via the SearchParts parameter. This is documented across multiple feeds (NVD entry and mirrored records) and is described as a SQL injec...
PT-2018-14962
Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description An issue was discovered in the Manufacturing component. It has Blind SQL Injection via the SearchParts parameter in CollectiveWorkOrderCost.php. Recommendations For webERP version 4.15, avoid using the SearchPar...
CVE-2018-19436: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter...
PT-2018-14960
Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description An issue was discovered on the Bank Account Matching - Receipts screen of the General Ledger component. This issue involves Blind SQL injection via the AmtClear parameter in BankMatching.php. Recommendations For...
NoSQL injection
Overview Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query...
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection Reflected Cross-Site Scripting
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection Reflected Cross-Site Scripting Title: Blind SQL injection and multiple reflected XSS vulnerabilities in Wordpress Plugin Arigato Autoresponder and Newsletter v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2018-08-22...
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
Title: Blind SQL injection and multiple reflected XSS vulnerabilities in Wordpress Plugin Arigato Autoresponder and Newsletter v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2018-08-22...
CVE-2018-16724
The CVE-2018-16724 entry concerns baijiacms V4 with a reported Blind SQL Injection through the order parameter in the request using the path index.php?act=index . Connected documents corroborate this vulnerability as a SQL injection issue, with descriptions noting remote attackers could leverage ...
PT-2018-13701
Name of the Vulnerable Software and Affected Versions baijiacms version V4 Description A Blind SQL Injection issue exists via the order parameter in an "index.php?act=index" request. Recommendations For baijiacms version V4, avoid using the order parameter in the "index.php?act=index" request unt...
mooSocial Store Plugin 2.6 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL:...
mooSocial Store 2.6 SQL Injection
Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...
mooSocial Store Plugin 2.6 - SQL Injection
Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...
Mail.ru: Blind SQL injection [https://honor.hi-tech.mail.ru]
Blind boolean based SQLi in honor.hi-tech.mail.ru due to insecure use of GET parameter. Extended scope was not covered by bug bounty on the moment of reporting, the bounty was issued as a bonus...
CVE-2018-5384
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available...
Sql injection
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available...
CVE-2018-5384 Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available...
CVE-2018-5384
CVE-2018-5384 affects Navarino Infinity web interface up to version 2.2. The vulnerability is an unauthenticated, blind SQL injection in a exposed script, enabling an attacker to query the underlying PostgreSQL database and potentially achieve total compromise of the product. The CVE is documente...